0

I am evaluating the systemd-nspawn containers security and would like to know if the systemd-nspawn containers provide the same security guarantees as FreeBSD jails?

Specially, can an attacker escape from the container or manipulate the host?

0

Systemd-nspawn only manages isolated processes. It cannot isolate resources (which systemd can).

As a constructive difference, in the case of namespaces, you start with no isolation and you add whatever you require — mounts, PIDs, networks, users, etc. In the case of jails, you start with a reasonable secure baseline since the processes, IPCs, mounts and users are always isolated. That does not mean you can't get to the same level of security.

We can create a fully isolated environment, which will automatically monitor the /proc and /sys pseudo-file systems and create an isolated loop-back interface and separate name space for PIDs. From there we can run what we want.

To limit the isolation problem we can use systemctl:

systemctl set-property  CPUShares=80 CPUQuota=25% MemoryLimit=1024M

So to conclude, by default you don't have the same level of security but you can get to the same level. Nspawn will probably also evolve a lot more in the near future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.